hereya-cli 0.86.0 → 0.86.2

package/dist/commands/undeploy/index.js

@@ -2,12 +2,12 @@ import { Command, Flags } from '@oclif/core';
 import { getRendererClass, Listr, ListrLogger, ListrLogLevels } from 'listr2';
 import path from 'node:path';
 import { CloudBackend } from '../../backend/cloud/cloud-backend.js';
-import { getCloudCredentials, loadBackendConfig } from '../../backend/config.js';
 import { getBackend } from '../../backend/index.js';
 import { getExecutor } from '../../executor/index.js';
+import { getActiveCloudAuth } from '../../lib/active-cloud.js';
 import { getConfigManager } from '../../lib/config/index.js';
 import { getEnvManager } from '../../lib/env/index.js';
-import { getEphemeralToken, withEphemeralToken } from '../../lib/ephemeral-token.js';
+import { withEphemeralToken } from '../../lib/ephemeral-token.js';
 import { gitUtils } from '../../lib/git-utils.js';
 import { getDefaultLogger, getLogger, getLogPath, isDebug, setDebug } from '../../lib/log.js';
 import { getParameterManager } from '../../lib/parameter/index.js';
@@ -338,41 +338,19 @@ See ${getLogPath()} for more details`);
             this.error(cleanCheck.reason);
         }
         myLogger.log(ListrLogLevels.STARTED, `Undeploying ${input.workspace} via remote executor (branch: ${input.gitBranch})`);
-        // 2. Get cloud backend for job submission. If we are inside an ephemeral
-        // token scope (set by --token), use that token directly without touching
-        // the keychain or persisted credentials. Otherwise fall back to the
-        // standard "load credentials from disk + keychain" path.
-        const ephemeral = getEphemeralToken();
-        const resolvedWorkspaceName = resolveWorkspaceName(input.workspace, input.project);
-        let cloudBackend;
-        if (ephemeral) {
-            const url = ephemeral.cloudUrl
-                ?? process.env.HEREYA_CLOUD_URL
-                ?? (await loadBackendConfig()).cloud?.url
-                ?? 'https://cloud.hereya.dev';
-            cloudBackend = new CloudBackend({
-                accessToken: ephemeral.token,
-                clientId: '',
-                refreshToken: '',
-                url,
-            });
-        }
-        else {
-            const backendConfig = await loadBackendConfig();
-            if (!backendConfig.cloud) {
-                this.error('Remote undeployment requires cloud backend. Run `hereya login` first.');
-            }
-            const credentials = await getCloudCredentials(backendConfig.cloud.clientId);
-            if (!credentials) {
-                this.error('Cloud credentials not found. Run `hereya login` first.');
-            }
-            cloudBackend = new CloudBackend({
-                accessToken: credentials.accessToken,
-                clientId: backendConfig.cloud.clientId,
-                refreshToken: credentials.refreshToken,
-                url: backendConfig.cloud.url,
-            });
+        // 2. Resolve cloud auth (ephemeral --token first, then persisted creds)
+        // and build a CloudBackend for job submission + polling.
+        const auth = await getActiveCloudAuth();
+        if (!auth) {
+            this.error('Remote undeployment requires cloud backend. Run `hereya login` or pass `--token <token>`.');
         }
+        const resolvedWorkspaceName = resolveWorkspaceName(input.workspace, input.project);
+        const cloudBackend = new CloudBackend({
+            accessToken: auth.accessToken,
+            clientId: auth.clientId ?? '',
+            refreshToken: auth.refreshToken ?? '',
+            url: auth.cloudUrl,
+        });
         // 3. Submit undeploy job
         const submitResult = await cloudBackend.submitExecutorJob({
             payload: {

package/dist/executor/context.js

@@ -1,16 +1,17 @@
-import { getCloudCredentials, loadBackendConfig } from '../backend/config.js';
-import { BackendType, getBackend } from '../backend/index.js';
+import { getBackend } from '../backend/index.js';
+import { getActiveCloudAuth } from '../lib/active-cloud.js';
 import { resolveWorkspaceName } from '../lib/workspace-utils.js';
 import { getExecutor } from './index.js';
 export async function getExecutorForWorkspace(workspaceName, project) {
     if (!workspaceName) {
         return getExecutor();
     }
-    const backendConfig = await loadBackendConfig();
-    if (backendConfig.current !== BackendType.Cloud) {
-        return getExecutor();
-    }
-    if (!backendConfig.cloud) {
+    // Honors both `hereya login` (persisted on disk) and an in-scope
+    // ephemeral `--token`. Without this, `--token` invocations silently
+    // fell through to the local executor regardless of whether the
+    // workspace actually has a remote executor.
+    const auth = await getActiveCloudAuth();
+    if (!auth) {
         return getExecutor();
     }
     const resolvedName = resolveWorkspaceName(workspaceName, project);
@@ -23,16 +24,12 @@ export async function getExecutorForWorkspace(workspaceName, project) {
     if (!workspace.hasExecutor) {
         return getExecutor();
     }
-    const credentials = await getCloudCredentials(backendConfig.cloud.clientId);
-    if (!credentials) {
-        return getExecutor();
-    }
     return getExecutor({
         cloudConfig: {
-            accessToken: credentials.accessToken,
-            clientId: backendConfig.cloud.clientId,
-            refreshToken: credentials.refreshToken,
-            url: backendConfig.cloud.url,
+            accessToken: auth.accessToken,
+            clientId: auth.clientId ?? '',
+            refreshToken: auth.refreshToken ?? '',
+            url: auth.cloudUrl,
         },
         workspace: resolvedName,
     });

package/dist/lib/active-cloud.d.ts

@@ -0,0 +1,31 @@
+/**
+ * The active cloud auth credentials for this CLI invocation.
+ *
+ * Either sourced from an ephemeral `--token` (in which case `clientId` and
+ * `refreshToken` are `null` because there is no persisted client identity
+ * and the token cannot be refreshed) or from the persisted `backend.yaml`
+ * + keychain credentials.
+ */
+export interface ActiveCloudAuth {
+    accessToken: string;
+    clientId: null | string;
+    cloudUrl: string;
+    refreshToken: null | string;
+}
+/**
+ * Returns the active cloud auth, preferring an in-scope ephemeral `--token`
+ * over the persisted `backend.yaml` + keychain credentials. Returns `null`
+ * when neither is available.
+ *
+ * **This is the single source of truth for "are we authenticated to
+ * hereya-cloud right now?"** — every code path that previously read from
+ * `loadBackendConfig()` + `getCloudCredentials()` directly (and therefore
+ * silently ignored an ephemeral `--token`) should call this instead.
+ */
+export declare function getActiveCloudAuth(): Promise<ActiveCloudAuth | null>;
+/**
+ * Whether the cloud backend is "active" — either via `hereya login` or via
+ * an in-scope ephemeral `--token`. Used to decide whether to consult the
+ * cloud package registry, the remote executor, etc.
+ */
+export declare function isCloudBackendActive(): Promise<boolean>;

package/dist/lib/active-cloud.js

@@ -0,0 +1,55 @@
+import { getCloudCredentials, loadBackendConfig } from '../backend/config.js';
+import { BackendType } from '../backend/index.js';
+import { getEphemeralToken } from './ephemeral-token.js';
+const DEFAULT_CLOUD_URL = 'https://cloud.hereya.dev';
+/**
+ * Returns the active cloud auth, preferring an in-scope ephemeral `--token`
+ * over the persisted `backend.yaml` + keychain credentials. Returns `null`
+ * when neither is available.
+ *
+ * **This is the single source of truth for "are we authenticated to
+ * hereya-cloud right now?"** — every code path that previously read from
+ * `loadBackendConfig()` + `getCloudCredentials()` directly (and therefore
+ * silently ignored an ephemeral `--token`) should call this instead.
+ */
+export async function getActiveCloudAuth() {
+    const ephemeral = getEphemeralToken();
+    if (ephemeral) {
+        const cloudUrl = ephemeral.cloudUrl
+            ?? process.env.HEREYA_CLOUD_URL
+            ?? (await loadBackendConfig()).cloud?.url
+            ?? DEFAULT_CLOUD_URL;
+        return {
+            accessToken: ephemeral.token,
+            clientId: null,
+            cloudUrl,
+            refreshToken: null,
+        };
+    }
+    const config = await loadBackendConfig();
+    if (config.current !== BackendType.Cloud || !config.cloud) {
+        return null;
+    }
+    const credentials = await getCloudCredentials(config.cloud.clientId);
+    if (!credentials) {
+        return null;
+    }
+    return {
+        accessToken: credentials.accessToken,
+        clientId: config.cloud.clientId,
+        cloudUrl: config.cloud.url,
+        refreshToken: credentials.refreshToken,
+    };
+}
+/**
+ * Whether the cloud backend is "active" — either via `hereya login` or via
+ * an in-scope ephemeral `--token`. Used to decide whether to consult the
+ * cloud package registry, the remote executor, etc.
+ */
+export async function isCloudBackendActive() {
+    if (getEphemeralToken()) {
+        return true;
+    }
+    const config = await loadBackendConfig();
+    return config.current === BackendType.Cloud;
+}

package/dist/lib/hereya-token.js

@@ -1,22 +1,21 @@
-import { getCloudCredentials, loadBackendConfig } from '../backend/config.js';
+import { getActiveCloudAuth } from './active-cloud.js';
 export const hereyaTokenUtils = {
     async generateHereyaToken(description) {
-        const backendConfig = await loadBackendConfig();
-        if (!backendConfig.cloud) {
-            return null;
-        }
-        const { clientId, url } = backendConfig.cloud;
-        const credentials = await getCloudCredentials(clientId);
-        if (!credentials) {
+        // Honors both `hereya login` (persisted) and an in-scope ephemeral
+        // `--token`. Note: workspace-scoped CLI tokens (kind:"cli") are
+        // intentionally rejected by the cloud's /api/personal-tokens route —
+        // only user-level tokens can mint long-lived personal tokens.
+        const auth = await getActiveCloudAuth();
+        if (!auth) {
             return null;
         }
         const formData = new FormData();
         formData.append('description', description);
         formData.append('expiresInDays', '365');
-        const response = await fetch(`${url}/api/personal-tokens`, {
+        const response = await fetch(`${auth.cloudUrl}/api/personal-tokens`, {
             body: formData,
             headers: {
-                Authorization: `Bearer ${credentials.accessToken}`,
+                Authorization: `Bearer ${auth.accessToken}`,
             },
             method: 'POST',
         });
@@ -24,6 +23,6 @@ export const hereyaTokenUtils = {
             return null;
         }
         const result = await response.json();
-        return { cloudUrl: url, token: result.data.token };
+        return { cloudUrl: auth.cloudUrl, token: result.data.token };
     },
 };

package/dist/lib/package/index.js

@@ -1,9 +1,9 @@
 import * as yaml from 'yaml';
 import { z } from 'zod';
-import { getCurrentBackendType } from '../../backend/config.js';
-import { BackendType, getBackend } from '../../backend/index.js';
+import { getBackend } from '../../backend/index.js';
 import { IacType } from '../../iac/common.js';
 import { InfrastructureType } from '../../infrastructure/common.js';
+import { isCloudBackendActive } from '../active-cloud.js';
 import { CloudPackageManager } from './cloud.js';
 import { GitHubPackageManager } from './github.js';
 import { LocalPackageManager } from './local.js';
@@ -31,23 +31,21 @@ export async function resolvePackage(input) {
         return { found: false, reason: 'Invalid package format. Package name cannot contain dots (.) nor double dashes (--)' };
     }
     const isLocal = packageName.startsWith('local/');
-    // Try cloud first if not local and backend is cloud
-    if (!isLocal) {
-        const backendType = await getCurrentBackendType();
-        if (backendType === BackendType.Cloud) {
-            const result = await tryCloudResolution(input);
-            if (result.found) {
-                return result; // Success
-            }
-            // Failed - check if we should fallback to GitHub or return the error
-            if (!packageName.includes('/')) {
-                // Simple package names can't fallback to GitHub, return the detailed error
-                return result;
-            }
-            // For owner/repo format, we can fallback to GitHub
-            input.logger?.debug(`Package ${packageName} not found in registry, trying GitHub...`);
-            input.logger?.debug(`Registry error: ${result.reason}`);
+    // Try cloud first if not local and backend is cloud (or an ephemeral
+    // --token is in scope, which acts as Cloud regardless of on-disk config).
+    if (!isLocal && await isCloudBackendActive()) {
+        const result = await tryCloudResolution(input);
+        if (result.found) {
+            return result; // Success
         }
+        // Failed - check if we should fallback to GitHub or return the error
+        if (!packageName.includes('/')) {
+            // Simple package names can't fallback to GitHub, return the detailed error
+            return result;
+        }
+        // For owner/repo format, we can fallback to GitHub
+        input.logger?.debug(`Package ${packageName} not found in registry, trying GitHub...`);
+        input.logger?.debug(`Registry error: ${result.reason}`);
     }
     // Determine protocol for standard resolution
     const protocol = isLocal ? 'local' : '';
@@ -63,12 +61,10 @@ export async function downloadPackage(pkgUrl, destPath) {
     if (pkgUrl.startsWith('local/')) {
         protocol = 'local';
     }
-    else if (pkgUrl.includes('#')) {
-        // Registry package URLs contain commit SHA
-        const backendType = await getCurrentBackendType();
-        if (backendType === BackendType.Cloud) {
-            protocol = 'cloud';
-        }
+    else if (pkgUrl.includes('#') && await isCloudBackendActive()) {
+        // Registry package URLs contain commit SHA. Cloud branch fires when
+        // backend.yaml says Cloud OR an ephemeral --token is in scope.
+        protocol = 'cloud';
     }
     // Otherwise defaults to GitHub
     const packageManager = await getPackageManager(protocol);